CVE catalog

CVE-2024-47607

GStreamer Base Plugins vulnerabilities

Severity: Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: Dec 3, 2024, 11:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.20% · Oct 25, 2026

GStreamer is a library for constructing graphs of media-handling components. stack-buffer overflow has been detected in the gst_opus_dec_parse_header function within `gstopusdec.c'. The pos array is a stack-allocated buffer of size 64. If n_channels exceeds 64, the for loop will write beyond the boundaries of the pos array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This bug allows to overwrite the EIP address allocated in the stack. This vulnerability is fixed in 1.24.10.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	gst-plugins-base1.0	sid	`1.28.8-1`	fixed
Debian	gst-plugins-base1.0	forky	`1.28.8-1`	fixed
Debian	gst-plugins-base1.0	trixie	`1.26.2-1+deb13u1`	fixed
Debian	gst-plugins-base1.0	trixie-security	`1.26.2-1+deb13u2`	fixed
Debian	gst-plugins-base1.0	bookworm	`1.22.0-3+deb12u6`	fixed
Debian	gst-plugins-base1.0	bookworm-security	`1.22.0-3+deb12u7`	fixed
Ubuntu	gst-plugins-base1.0	noble	`1.24.2-1ubuntu0.2`	fixed
Ubuntu	gir1.2-gst-plugins-base-1.0	noble	`1.24.2-1ubuntu0.2`	fixed
Ubuntu	gstreamer1.0-alsa	noble	`1.24.2-1ubuntu0.2`	fixed
Ubuntu	gstreamer1.0-gl	noble	`1.24.2-1ubuntu0.2`	fixed
Ubuntu	gstreamer1.0-plugins-base	noble	`1.24.2-1ubuntu0.2`	fixed
Ubuntu	gstreamer1.0-plugins-base-apps	noble	`1.24.2-1ubuntu0.2`	fixed
Ubuntu	gstreamer1.0-x	noble	`1.24.2-1ubuntu0.2`	fixed
Ubuntu	libgstreamer-gl1.0-0	noble	`1.24.2-1ubuntu0.2`	fixed
Ubuntu	libgstreamer-plugins-base1.0-0	noble	`1.24.2-1ubuntu0.2`	fixed
Ubuntu	libgstreamer-plugins-base1.0-dev	noble	`1.24.2-1ubuntu0.2`	fixed
Ubuntu	gst-plugins-base1.0	pro	`1.12.3-1`	vulnerable
Ubuntu	gst-plugins-base1.0	pro	`1.12.4-1`	vulnerable
Ubuntu	gst-plugins-base1.0	pro	`1.13.1-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-base1.0	pro	`1.13.91-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-base1.0	pro	`1.14.0-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-base1.0	pro	`1.14.0-2ubuntu1`	vulnerable
Ubuntu	gst-plugins-base1.0	pro	`1.14.1-1ubuntu1~ubuntu18.04.1`	vulnerable
Ubuntu	gst-plugins-base1.0	pro	`1.14.1-1ubuntu1~ubuntu18.04.2`	vulnerable
Ubuntu	gst-plugins-base1.0	pro	`1.14.4-1ubuntu1.1~ubuntu18.04.1`	vulnerable
Ubuntu	gst-plugins-base1.0	pro	`1.14.5-0ubuntu1~18.04.1`	vulnerable
Ubuntu	gst-plugins-base1.0	pro	`1.14.5-0ubuntu1~18.04.2`	vulnerable
Ubuntu	gst-plugins-base1.0	pro	`1.14.5-0ubuntu1~18.04.3`	vulnerable
Ubuntu	gst-plugins-base1.0	pro	`1.14.5-0ubuntu1~18.04.3+esm1`	fixed
Ubuntu	gst-plugins-base0.10	16.04	`0.10.36-2`	vulnerable
Ubuntu	gst-plugins-base0.10	16.04	`0.10.36-2ubuntu0.1`	vulnerable
Ubuntu	gst-plugins-base0.10	16.04	`0.10.36-2ubuntu0.2`	vulnerable
Ubuntu	gst-plugins-base1.0	20.04	`1.16.1-1`	vulnerable
Ubuntu	gst-plugins-base1.0	20.04	`1.16.2-1`	vulnerable
Ubuntu	gst-plugins-base1.0	20.04	`1.16.2-2`	vulnerable
Ubuntu	gst-plugins-base1.0	20.04	`1.16.2-2ubuntu3`	vulnerable
Ubuntu	gst-plugins-base1.0	20.04	`1.16.2-2ubuntu4`	vulnerable
Ubuntu	gst-plugins-base1.0	20.04	`1.16.2-4`	vulnerable
Ubuntu	gst-plugins-base1.0	20.04	`1.16.2-4ubuntu0.1`	vulnerable
Ubuntu	gst-plugins-base1.0	20.04	`1.16.3-0ubuntu1`	vulnerable
Ubuntu	gst-plugins-base1.0	20.04	`1.16.3-0ubuntu1.1`	vulnerable
Ubuntu	gst-plugins-base1.0	20.04	`1.16.3-0ubuntu1.2`	vulnerable
Ubuntu	gst-plugins-base1.0	20.04	`1.16.3-0ubuntu1.3`	vulnerable
Ubuntu	gst-plugins-base1.0	20.04	`1.16.3-0ubuntu1.4`	fixed
Ubuntu	gst-plugins-base1.0	22.04	`1.18.5-1`	vulnerable
Ubuntu	gst-plugins-base1.0	22.04	`1.19.90-1`	vulnerable
Ubuntu	gst-plugins-base1.0	22.04	`1.20.0-1`	vulnerable
Ubuntu	gst-plugins-base1.0	22.04	`1.20.0-2`	vulnerable
Ubuntu	gst-plugins-base1.0	22.04	`1.20.1-1`	vulnerable
Ubuntu	gst-plugins-base1.0	22.04	`1.20.1-1ubuntu0.1`	vulnerable
Ubuntu	gst-plugins-base1.0	22.04	`1.20.1-1ubuntu0.2`	vulnerable
Ubuntu	gst-plugins-base1.0	22.04	`1.20.1-1ubuntu0.4`	fixed
Ubuntu	gst-plugins-base1.0	24.04	`1.22.6-1`	vulnerable
Ubuntu	gst-plugins-base1.0	24.04	`1.22.7-1`	vulnerable
Ubuntu	gst-plugins-base1.0	24.04	`1.22.8-1`	vulnerable
Ubuntu	gst-plugins-base1.0	24.04	`1.22.10-1`	vulnerable
Ubuntu	gst-plugins-base1.0	24.04	`1.24.1-1`	vulnerable
Ubuntu	gst-plugins-base1.0	24.04	`1.24.1-1build1`	vulnerable
Ubuntu	gst-plugins-base1.0	24.04	`1.24.2-1`	vulnerable
Ubuntu	gst-plugins-base1.0	24.04	`1.24.2-1ubuntu0.1`	vulnerable
Ubuntu	gst-plugins-base1.0	24.04	`1.24.2-1ubuntu0.2`	fixed
Alpine	gst-plugins-base	3.20	`1.24.10-r0`	fixed
Alpine	gst-plugins-base	3.21	`1.24.10-r0`	fixed
Alpine	gst-plugins-base	3.22	`1.24.10-r0`	fixed
Alpine	gst-plugins-base	3.23	`1.24.10-r0`	fixed
Alpine	gst-plugins-base	3.24	`1.24.10-r0`	fixed
Opensuse	gstreamer-plugins-base	tumbleweed	`1.24.11-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	gst-plugins-base1.0	source	sid	`1.24.10-1`	not yet assigned	Not reported	Not reported
Debian	gst-plugins-base1.0	source	forky	`1.24.10-1`	not yet assigned	Not reported	Not reported
Debian	gst-plugins-base1.0	source	trixie	`1.24.10-1`	not yet assigned	Not reported	Not reported
Debian	gst-plugins-base1.0	source	bookworm	`1.22.0-3+deb12u3`	not yet assigned	Not reported	Not reported
Ubuntu	gst-plugins-base1.0	deb	noble	`1.24.2-1ubuntu0.2`	Not reported	Not reported	Not reported
Ubuntu	gir1.2-gst-plugins-base-1.0	deb	noble	`1.24.2-1ubuntu0.2`	Not reported	Not reported	Not reported
Ubuntu	gstreamer1.0-alsa	deb	noble	`1.24.2-1ubuntu0.2`	Not reported	Not reported	Not reported
Ubuntu	gstreamer1.0-gl	deb	noble	`1.24.2-1ubuntu0.2`	Not reported	Not reported	Not reported
Ubuntu	gstreamer1.0-plugins-base	deb	noble	`1.24.2-1ubuntu0.2`	Not reported	Not reported	Not reported
Ubuntu	gstreamer1.0-plugins-base-apps	deb	noble	`1.24.2-1ubuntu0.2`	Not reported	Not reported	Not reported
Ubuntu	gstreamer1.0-x	deb	noble	`1.24.2-1ubuntu0.2`	Not reported	Not reported	Not reported
Ubuntu	libgstreamer-gl1.0-0	deb	noble	`1.24.2-1ubuntu0.2`	Not reported	Not reported	Not reported
Ubuntu	libgstreamer-plugins-base1.0-0	deb	noble	`1.24.2-1ubuntu0.2`	Not reported	Not reported	Not reported
Ubuntu	libgstreamer-plugins-base1.0-dev	deb	noble	`1.24.2-1ubuntu0.2`	Not reported	Not reported	Not reported
Ubuntu	gst-plugins-base1.0	deb	pro	`1.14.5-0ubuntu1~18.04.3+esm1`	Not reported	UBUNTU-CVE-2024-47607	Not reported
Ubuntu	gst-plugins-base1.0	deb	20.04	`1.16.3-0ubuntu1.4`	Not reported	UBUNTU-CVE-2024-47607	Not reported
Ubuntu	gst-plugins-base1.0	deb	22.04	`1.20.1-1ubuntu0.4`	Not reported	UBUNTU-CVE-2024-47607	Not reported
Ubuntu	gst-plugins-base1.0	deb	24.04	`1.24.2-1ubuntu0.2`	Not reported	UBUNTU-CVE-2024-47607	Not reported
Alpine	gst-plugins-base	apk	3.20	`1.24.10-r0`	Not reported	ALPINE-CVE-2024-47607	Not reported
Alpine	gst-plugins-base	apk	3.21	`1.24.10-r0`	Not reported	ALPINE-CVE-2024-47607	Not reported
Alpine	gst-plugins-base	apk	3.22	`1.24.10-r0`	Not reported	ALPINE-CVE-2024-47607	Not reported
Alpine	gst-plugins-base	apk	3.23	`1.24.10-r0`	Not reported	ALPINE-CVE-2024-47607	Not reported
Alpine	gst-plugins-base	apk	3.24	`1.24.10-r0`	Not reported	ALPINE-CVE-2024-47607	Not reported
Opensuse	gstreamer-plugins-base	rpm	tumbleweed	`1.24.11-1.1`	Not reported	OPENSUSE-SU-2025:14625-1	Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

[gstreamer-plugins-base-32bit]Unknown
Source package: [gstreamer-plugins-base]
Details (1)
- 1.28.6-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.24.11-1.1
  Version impact unknown
  usn · gstreamer-plugins-base · opensuse · tumbleweed
[gstreamer-plugins-base-devel]Unknown
Source package: [gstreamer-plugins-base]
Details (1)
- 1.28.6-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.24.11-1.1
  Version impact unknown
  usn · gstreamer-plugins-base · opensuse · tumbleweed
[gstreamer-plugins-base-devel-32bit]Unknown
Source package: [gstreamer-plugins-base]
Details (1)
- 1.28.6-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.24.11-1.1
  Version impact unknown
  usn · gstreamer-plugins-base · opensuse · tumbleweed
[gstreamer-plugins-base-extra]Unknown
Source package: [gstreamer-plugins-base]
Details (1)
- 1.28.6-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.24.11-1.1
  Version impact unknown
  usn · gstreamer-plugins-base · opensuse · tumbleweed
[gstreamer-plugins-base-lang]Unknown
Source package: [gstreamer-plugins-base]
Details (1)
- 1.28.6-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.24.11-1.1
  Version impact unknown
  usn · gstreamer-plugins-base · opensuse · tumbleweed
[libgstallocators-1_0-0]Unknown
Source package: [gstreamer-plugins-base]
Details (1)
- 1.28.6-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.24.11-1.1
  Version impact unknown
  usn · gstreamer-plugins-base · opensuse · tumbleweed
[libgstallocators-1_0-0-32bit]Unknown
Source package: [gstreamer-plugins-base]
Details (1)
- 1.28.6-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.24.11-1.1
  Version impact unknown
  usn · gstreamer-plugins-base · opensuse · tumbleweed
[libgstapp-1_0-0]Unknown
Source package: [gstreamer-plugins-base]
Details (1)
- 1.28.6-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.24.11-1.1
  Version impact unknown
  usn · gstreamer-plugins-base · opensuse · tumbleweed
[libgstapp-1_0-0-32bit]Unknown
Source package: [gstreamer-plugins-base]
Details (1)
- 1.28.6-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.24.11-1.1
  Version impact unknown
  usn · gstreamer-plugins-base · opensuse · tumbleweed
[libgstaudio-1_0-0]Unknown
Source package: [gstreamer-plugins-base]
Details (1)
- 1.28.6-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.24.11-1.1
  Version impact unknown
  usn · gstreamer-plugins-base · opensuse · tumbleweed
[libgstaudio-1_0-0-32bit]Unknown
Source package: [gstreamer-plugins-base]
Details (1)
- 1.28.6-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.24.11-1.1
  Version impact unknown
  usn · gstreamer-plugins-base · opensuse · tumbleweed
[libgstfft-1_0-0]Unknown
Source package: [gstreamer-plugins-base]
Details (1)
- 1.28.6-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.24.11-1.1
  Version impact unknown
  usn · gstreamer-plugins-base · opensuse · tumbleweed
[libgstfft-1_0-0-32bit]Unknown
Source package: [gstreamer-plugins-base]
Details (1)
- 1.28.6-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.24.11-1.1
  Version impact unknown
  usn · gstreamer-plugins-base · opensuse · tumbleweed
[libgstgl-1_0-0]Unknown
Source package: [gstreamer-plugins-base]
Details (1)
- 1.28.6-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.24.11-1.1
  Version impact unknown
  usn · gstreamer-plugins-base · opensuse · tumbleweed
[libgstgl-1_0-0-32bit]Unknown
Source package: [gstreamer-plugins-base]
Details (1)
- 1.28.6-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.24.11-1.1
  Version impact unknown
  usn · gstreamer-plugins-base · opensuse · tumbleweed
[libgstpbutils-1_0-0]Unknown
Source package: [gstreamer-plugins-base]
Details (1)
- 1.28.6-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.24.11-1.1
  Version impact unknown
  usn · gstreamer-plugins-base · opensuse · tumbleweed
[libgstpbutils-1_0-0-32bit]Unknown
Source package: [gstreamer-plugins-base]
Details (1)
- 1.28.6-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.24.11-1.1
  Version impact unknown
  usn · gstreamer-plugins-base · opensuse · tumbleweed
[libgstriff-1_0-0]Unknown
Source package: [gstreamer-plugins-base]
Details (1)
- 1.28.6-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.24.11-1.1
  Version impact unknown
  usn · gstreamer-plugins-base · opensuse · tumbleweed
[libgstriff-1_0-0-32bit]Unknown
Source package: [gstreamer-plugins-base]
Details (1)
- 1.28.6-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.24.11-1.1
  Version impact unknown
  usn · gstreamer-plugins-base · opensuse · tumbleweed
[libgstrtp-1_0-0]Unknown
Source package: [gstreamer-plugins-base]
Details (1)
- 1.28.6-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.24.11-1.1
  Version impact unknown
  usn · gstreamer-plugins-base · opensuse · tumbleweed

Next results

Observed: Oct 27, 2026, 6:46:31 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]